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Authority 



Executive Order (E.O.) 12958, as amended, “Classified National Security Information,” and E.O. 
12829, as amended, “National Industrial Security Program.” The Information Security Oversight 
Office (ISOO) is a component of the National Archives and Records Administration (NARA) and 
receives its policy and program guidance from the National Security Council (NSC). On December 
29, 2009, President Obama issued E.O. 13526, “Classified National Security Information,” which will 
be fully implemented 180 days hence. 



ISOO oversees the security classification programs in both Government and industry and reports 
annually to the President on their status. 



■ Develops implementing directives and instructions. 

■ Maintains liaison relationships with agency counterparts and conducts on-site and document 
reviews to monitor agency compliance. 

■ Develops and disseminates security education materials for Government and industry; monitors 
security education and training programs. 

■ Receives and takes action on complaints, appeals, and suggestions. 

■ Collects and analyzes relevant statistical data and, along with other information, reports them 
annually to the President. 

■ Serves as spokesperson to Congress, the media, special interest groups, professional 
organizations, and the public. 

■ Conducts special studies on identified or potential problem areas and develops remedial 
approaches for program improvement. 

■ Recommends policy changes to the President through the NSC. 

■ Provides program and administrative support for the Interagency Security Classification Appeals 
Panel (ISCAP). 

■ Provides program and administrative support for the Public Interest Declassification Board (PIDB). 

■ Reviews requests for original classification authority from agencies. 

■ Chairs interagency meetings to discuss matters pertaining to both Executive orders. 

■ Reviews and approves agency implementing regulations and agency guides for systematic 
declassification review. 



■ Promotes and enhances the system that protects the national security information that safeguards 
the American people and their Government. 

■ Provides for an informed American public by ensuring that the minimum information necessary 
to the interest of national security is classified and that information is declassified as soon as it no 
longer requires protection. 

■ Promotes and enhances concepts that facilitate the sharing of information in the 



Mission 



Functions 



Goals 




■ Provides expert advice and guidance pertinent to the principles of information 
security. 



fulfillment of mission-critical functions related to national security. 







Letter to the President 



March 31, 2010 

The President 
The White House 
Washington, DC 20500 

Dear Mr. President: 

I am pleased to submit the Information Security Oversight Office’s (ISOO) Report to the President for Fiscal Year 2009. 

This report provides information on the status of the security classification program as required by Executive Order 
13526, “Classified National Security Information.” It provides statistics and analysis concerning key components of 
the system, primarily classification and declassification, and coverage of ISOO’s reviews. It also contains information 
with respect to industrial security in the private sector as required by Executive Order 12829, as amended, “National 
Industrial Security Program.” 

We believe the direction you have provided will garner the commitment that is necessary to support the integrity of 
the classification system and we will focus our oversight efforts in the remainder of FY 2010 on ensuring that agen- 
cies take the actions necessary to bolster the foundation of the classification system. Agencies must strike a balance 
between preserving, protecting, and advancing National Security and supporting the goal of conducting business in an 
open manner to the greatest extent possible. Only then will the American people be fully confident that the classified 
national security information program serves them well. 

There were several positive developments this year. Agencies have already made real progress in limiting the 
delegation of original classification authority. There was also a reduction in original classification activity (new 
“secrets”). Additionally, agencies assigned a duration of ten years or less in the highest percentage of original 
classification decisions since FY1996. 

However, our oversight efforts continue to identify shortcomings in agency implementation of basic requirements. Of 
particular concern are requirements related to implementing directives, security education and training, classification 
guides, and self-inspections. With the direction you provided on December 29, 2009, there is renewed emphasis on each 
of these critical areas but sustained vigilance on the part of senior leadership within the agencies is critical to success. 

Our data collection efforts also received renewed emphasis in FY 2009 as we sought to better reflect the way that 
classified information is used in the electronic environment. We issued revised guidance concerning the counting 
of classification actions which instructed agencies for the first time to include classification decisions in whatever 
medium they might occur. As a result, the number of reported derivative classification decisions has increased 
significantly. This does not reflect an increase in classification activity during FY 2009 but rather improved reporting 
of classification activity. We do not expect the data to stabilize until FY 2011, the first full year of implementation of 
Executive Order 13526, at which time we will have a new baseline. 



Respectfully, 





William J. Bosanko 
Director 
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Summary of FY 2009 Program Activity 



Classification 

■ Executive branch agencies reported 2,557 
original classification authorities. 

■ Agencies reported 183,224 original 
classification decisions. 

■ Agencies reported using the ten-year-or-less 
declassification instruction for 67 percent of 
original classification decisions. 

■ Executive branch agencies reported 54,65 1 ,765 
derivative classification decisions. 

■ Forty-six percent of the classification guides 
reported as being currently in use had not been 
updated within the past five years as required. 



Declassification 

■ Under automatic and systematic 
declassification reviews, agencies reviewed 
51,983,587 pages and declassified 28,812,249 
pages of historically valuable records. 

■ Agencies received 7,843 initial mandatory 
declassification review (MDR) requests. 

■ Agencies reviewed 293,064 pages under 
MDR, and declassified 203,142 pages in their 
entirety, declassified 68,722 pages in part, 
and retained classification of 21,200 pages in 
their entirety. 

■ Agencies reported carrying over 6,582 initial 
MDR requests into FY 2010. 

■ Agencies received 186 MDR appeals and 
processed 177 appeals. 

■ Agencies declassified 1,350 pages in their 
entirety on appeal, declassified 3,329 pages in 
part, and retained classification of 1,654 pages 
in their entirety 
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Classification 



Original Classification 

Original classification is an initial determination 
by an OCA that information owned by, produced 
by or for, or under the control of the United 
States Government requires protection because 
unauthorized disclosure of that information 
could reasonably be expected to cause damage to 
national security. In essence, these are the only 
new “secrets.” 



The process of original classification must always 
include a determination by an OCA of the concise 
reason for the classification that falls within one or 
more of the authorized categories of classification, 
the placement of markings to identify the information 
as classified, and the date or event when the 
information becomes declassified. By definition, 
original classification precedes all other aspects of 
the security classification system, including derivative 
classification, safeguarding, and declassification. 
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Original Classification Activity, FY 2009 



183,224 




Top Secret Secret Confidential TOTAL 



In FY 2009, the ten-year-or-less declassification instruction was used 67 
percent of the time, the highest percentage to date. 
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Original Classification Activity, FY 1989 - FY 2009 
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FY 2009 Original Classification 
Activity by Agency 


Department of the Army 


75,080 


Department of State 


55,224 


Department of Justice 


48,950 


Executive Office of the President 


1,609 


Department of Defense 


967 


Department of the Air Force 


665 


Department of the Navy 


502 


Department of Homeland Security 


178 


Department of Agriculture 


25 


Department of Treasury 


10 


Central Intelligence Agency 


4 


Millennium Challenge Corporation 


4 


Department of Health and 
Human Services 


2 


Office of the Director of 
National Intelligence 


2 


U.S. Agency for International Development 


1 


Department of Commerce 


1 


Total 


183,224 



Agencies reported 183,224 original 
classification decisions for FY 2009, a 10 
percent decrease from the 203,541 decisions 
reported in FY 2008. From FY 1996 
through FY 2009, the annual average of 
original classification decisions is 211,843. 

The large number of original classification 
actions is of concern, particularly with 
those agencies that have reported high 
numbers over time. We question whether 
many of these are truly original decisions. 
From a policy perspective, there should 
be little original classification activity and 
agencies should instead be relying upon 
classification guides. 

For the fifth year in a row, the majority 
of original classification decisions were 
assigned declassification dates of ten years 
or less. In FY 2009, the ten-year-or-less 
declassification instruction was used 67 
percent of the time, an increase over the 58 
percent reported in FY 2008 and the highest 
percentage to date. 
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Agencies reported 2 r 557 OCAs in FY 2009, down from 4,109 reported in FY 
2008. This is less than the average number of OCAs for FY 1980 through FY 
2008 (5,400) and, in fact, is the lowest number of OCAs ever reported. 



Use of the "Ten-Years-or-Less" Declassification Category 




Original Classifiers 

Original classification authorities (OCA), also 
called original classifiers, are those individuals 
designated in writing, either by the President, 
by selected agency heads, or by designated 
senior agency officials with Top Secret original 
classification authority, to classify information 
in the first instance. Only original classifiers are 
authorized to determine what information, if 
disclosed without authorization, could reasonably 
be expected to cause damage to national security. 



Original classifiers must be able to identify or 
describe the damage. Agencies reported 2,557 
OCAs in FY 2009, down from 4,109 reported in 
FY 2008. This is less than the average number 
of OCAs for FY 1980 through FY 2008 (5,400) 
and, in fact, is the lowest number of OCAs ever 
reported. Nearly all of this decrease comes from 
the Department of State, which anticipated the 
President’s memorandum of December 29, 2009, 
and undertook a special effort to review its past 
delegations of OCA, resulting in a decrease from 
2,560 to 999. 
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Original Classification Authorities, FY 2009 
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Number of Original Classification Authorities, FY 1980 - FY 2009 
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ISOO worked with representatives of the agencies to develop and issue new 
guidance concerning the counting of classification actions, and agencies were 
asked to disregard the concept of the finished product and instead focus on 
classification decisions wherever they might occur. 



Derivative Classification 

Derivative classification is the act of incorporating, 
paraphrasing, restating, or generating in new form 
information that is already classified and, therefore, 
are not considered new “secrets.” Information 
may be derivatively classified in two ways: (1) 
through the use of a source document, usually 
correspondence or publications generated by an 
OCA; or (2) through the use of a classification 
guide. A classification guide is a set of instructions 
issued by an OCA which identifies elements of 
information regarding a specific subject that must 
be classified and establishes the level and duration 
of classification for each such element. 

Derivative classification actions utilize information 
from the original category of classification. Since 
every derivative classification action is based on 
information whose classification has already been 
determined, it is essential that the origin of these 
actions be traceable to a decision by an OCA. 

Just as the policy has struggled to move beyond 
its paper-based origins, so too have we struggled 
with the counting of classification decisions in the 
electronic environment. Over time, methods of 
communicating classified information electronically 
have expanded significantly, to include classified 
web pages, blogs, wikis, bulletin boards, instant 
messaging, etc. This has been particularly true in 
recent years as agencies have sought to increase 
information sharing. Classified products are now 
disseminated to more consumers, and agencies 
are leveraging all forms of online tools to publish, 
inform, and collaborate. 

Our guidance has evolved over time from at first 
counting only derivative classification actions 
agencies considered to be finished products for 
retention or dissemination to more recently, when it 
was acknowledged that e-mail and other electronic 



products that might meet the same criteria. As 
a result, the data reported has not truly reflected 
the changing ways agencies have generated and 
used classified information in the electronic 
environment. Additionally, the treatment of such 
classification activity has become inconsistent 
as agency programs have faced this challenge 
in different ways. For example, the Central 
Intelligence Agency (CIA), which has always 
had one of the most mature means to provide 
statistically valid data, developed the capability 
to include electronic classification decisions early. 
As a result, over time the data made CIA appear 
responsible for the majority of all derivative 
classification, which ISOO knew was not the case 
through our other oversight activities. 

In FY 2009, ISOO worked with representatives of 
the agencies to develop and issue new guidance 
concerning the counting of classification actions, and 
agencies were asked to disregard the concept of the 
finished product and instead focus on classification 
decisions wherever they might occur. With respect 
to e-mail, agencies were asked not to count e-mail 
messages that were merely “replies” or “forwards” 
and instead count only those messages containing 
new original or derivative classification decisions. 

As we revised the guidance, we acknowledged that 
it might not be possible for all agencies to comply 
this fiscal year since counting in the electronic 
environment had never been done before in 
many agencies. Fortunately, some of the largest 
classifying agencies were able comply in FY 2009. 
The National Security Agency and the Department 
of Homeland Security (DHS) deserve special 
mention for their prompt compliance. Moreover, 
we acknowledged that including classification 
actions that occur in the electronic environment 
would likely significantly increase the number 
of classification decisions that we report. It is 
important to note that this does not reflect an 
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Agencies reported a total of 54.7 million derivative classification actions in FY 
2009, a 135 percent increase from the 23.2 million derivative actions reported 
in FY 2008. The increase is largely attributed to more accurate data provided 
by agencies using the revised guidance that better captured existing activity. 



increase in classification activity during FY 2009 
but rather improved reporting of classification 
activity that was already occurring. Understanding 
the rapidly changing ways in which agencies use 
classified information and adjusting the policy and 
our oversight remain significant challenges for 
ISOO, but steps such as the revised guidance are 
necessary despite the related additional challenges. 

Agencies reported a total of 54.7 million derivative 
classification actions in FY 2009, a 135 percent 
increase from the 23.2 million derivative actions 
reported in FY 2008. As noted above, the increase 



is largely attributed to more accurate data provided 
by agencies using the revised guidance that better 
captured existing activity. 

As agencies still face the challenge of providing 
a more accurate count of their activity, we do not 
expect the data to stabilize until FY 2011, the 
first full year of implementation of E.O. 13526, 
at which time we will have a new baseline. In 
the meantime, we are considering the data and 
how in FY 2010 we might estimate and report the 
classification activity that has occurred in the past 
in the electronic environment. 



Derivative Classification Activity, FY 2009 
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54,651,765 
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Derivative Classification Activity, FY 1996 - FY 2009 




*The dramatic increase between FY 2008 and FY 2009 derivative classification totals reflects 
ISOO's issuance of revised guidance concerning the counting of classification actions. 



Combined Original and Derivative 
Classification Activity 

Together, original and derivative classification 
decisions make up the combined classification 
activity. In FY 2009, the reported combined 
classification activity is 54.8 million decisions, 
an increase of 31.4 million over the 23.4 million 
decisions reported for FY 2008. The average 
combined classification activity from FY 1996 
through FY 2009 is 16.1 million decisions per year. 

Classification Challenges 

Classification challenges provide a mechanism to 
promote sound classification decisions. Authorized 
holders of information who, in good faith, believe 
its classification status is improper are encouraged 
and expected to challenge the classification status 



of that information. Classification challenges are 
handled both informally and formally, and provide 
individual holders the responsibility to question the 
appropriateness of the classification of information. 
ISOO’s program reviews have revealed that many 
authorized holders of classified information are 
not aware of this provision, and therefore, do not 
challenge classification decisions as much as should 
be expected in a robust system. Agencies reported 
365 formal challenges in FY 2009, down from 436 
reported in FY 2008. 

Most agencies need to improve the means by 
which authorized holders of classified information 
are alerted and reminded of the expectation for 
challenging classification. We recommend greater 
commitment by senior management and special 
emphasis as part of agency security education and 
training programs. 
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Combined Original and Derivative Classification Activity, FY 1996 - FY 2009 
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*The dramatic increase between FY 2008 and FY 2009 derivative classification totals reflects ISOO's issuance of 
revised guidance concerning the counting of classification actions. 
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54,834,989 



Declassification 

Background 

Declassification is defined as the authorized 
change in status of information from classified to 
unclassified and is an integral part of the security 
classification system. There are three declassification 
programs within the Executive branch: automatic 
declassification, systematic declassification review, 
and mandatory declassification review. Automatic 
declassification removes the classification of 
information at the close of every calendar year 
when that information reaches the 25 -year 
threshold. Systematic declassification review is 
required for those records exempted from automatic 
declassification. For purposes of this report, 
statistics reported for systematic declassification 
review and automatic declassification are combined 
because the execution of both programs is usually 
indistinguishable. Mandatory declassification 
review provides for direct, specific review for 
declassification of information when requested. 
Together, these three programs are essential to the 
viability of the classification system and vital to an 
open government. 




In " The Post/' on the Pennsylvania Avenue side of the build- 
ing , an aged figure with a scroll and closed book imparting the 
knowledge of past generations "stares down the corridors of 
time." The words on the base enjoin , "Study the Past" 



1.43 Billion Pages Declassified, FY 1980 - FY 2009* 



c 




* Excluding Mandatory Declassification Review 
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Statistical data shows that the percentage of pages being declassified remains 
relatively constant with an average of 55% of pages reviewed being declassified 
from FY 2004 through FY 2009. 



Pages Reviewed and 
Pages Declassified 

During FY 2009, the Executive branch reviewed 52 
million pages under the automatic and systematic 
declassification review provisions, an increase of 1 
percent from the 51.5 million pages reviewed in FY 

2008. The number of pages declassified decreased 
8 percent, from 31.4 million pages declassified in 
FY 2008 to 28.8 million pages declassified in FY 

2009. The Department of Defense (DoD), the 
Department of the Navy (Navy), the Department of 
the Army (Army), and the Department of the Air 
Force (Air Force), reviewed 36.9 million pages, or 
71 percent of the total number of pages reviewed by 
all agencies. Of the 28.8 million pages declassified 
by all agencies, DoD and the three military 
departments declassified 23.9 million pages which 
accounts for 83 percent of the total number of pages 
declassified. In FY 2008, agencies declassified 61 
percent of 51.5 million pages reviewed; in FY 2009, 
agencies declassified 55 percent of 52 million pages 
reviewed. Statistical data shows that the percentage 
of pages being declassified remains relatively 
constant with an average of 55 percent of pages 
reviewed being declassified from FY 2004 through 
FY 2009. 




"The Future" sits on the Pennsylvania Avenue side of the 
building. The young woman lifts her eyes from the pages 
of an open book and gazes into the future. Its base is 
inscribed with a line inspired by Shakespeare's play The 
Tempest: "What is Past is Prologue." 
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Number of Pages Reviewed and Declassified by Agency, FY 2009' 
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Pages Declassified 
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51,983,587 pages reviewed 



13,081,069 

7,475,317 




160,737 

73,127 



142,820 

142,820 



31,103 

24,047 



16,540 

8,662 



2,723 

767 



1,300 

305 



12 

12 



* Excluding Mandatory Declassification Review 
**Less Air Force , Army , Navy 

Note: It is important to point out that at several agencies the bulk of the records requiring review contain 
information originated by other agencies. Therefore , the bulk of the records must be referred to those agencies for 
declassification determinations. 
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Total Number of Pages Reviewed and Declassified,* FY 2004 - FY 2009 
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* Excluding Mandatory Declassification Review 



a Pages Reviewed [J Pages Declassified 



From FY 1996 through FY 2009, agencies received an average of 4,707 initial 
requests per fiscal year. Agencies received 7,843 initial requests for MDR in FY 
2009, slightly lower than the 8,264 requests received in FY 2008. 



Mandatory 

Declassification Review 

The MDR process requires a review of specific 
classified national security information in response 
to a request seeking its declassification. Requests 
must be in writing and describe the record 
containing the information with sufficient specificity 
to permit the agency receiving the request to 
locate it with a reasonable amount of effort. MDR 
remains popular with some researchers as a less 
litigious alternative to requests under the Freedom of 
Information Act, as amended (FOIA). It is also used 
to seek the declassification of Presidential papers or 
records not subject to FOIA. 

Initial Requests 

From FY 1996 through FY 2009, agencies 
received an average of 4,707 initial requests 
per fiscal year. Agencies received 7,843 initial 
requests for MDR in FY 2009, slightly lower 



than the 8,264 requests received in FY 2008. 

In FY 2009, DoD, including the three military 
departments, received a total of 4,645 initial 
requests, 59 percent of the Executive branch total. 
NARA received the second highest number of 
initial requests, at 1,481 (19 percent), and CIA 
received 1,139 initial requests (15 percent). When 
combined, these three agencies received 93 
percent of all initial MDR requests for FY 2009. 

Agencies processed 7,104 requests in FY 2009, 
a decrease of 303 requests from the previous 
fiscal year. DoD (3,458), NARA (1,305), and 
CIA (1,206) were responsible for processing 84 
percent of the MDR requests. The 7,104 requests 
processed in FY 2009 contained 293,064 pages. 
Of these, 203,142 pages were declassified in 
their entirety (69 percent); 68,722 pages were 
declassified in part (24 percent); and 21,200 pages 
remained classified in their entirety (7 percent). 
While the total number of pages processed 
increased by 31,781 pages, the percentage of pages 
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MDR Program Activity - Initial Requests 
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Agencies processed 7,104 requests in FY 2009, a decrease of 303 requests 
from the previous fiscal year. DoD (3,458), NARA (1,305), and CIA (1,206) 
were responsible for processing 84 percent of the MDR requests. 



declassified in their entirety, declassified in part, 
or denied in full remained statistically close to the 
numbers reported in FY 2008. 

MDR has proven to be a successful program. From 
FY 1996 through FY 2009, agencies received 
65,895 initial requests and processed 3,102,323 
pages. As a result of initial MDR processing, 
only 263,329 pages (9 percent) remained classified 
in their entirety after an initial MDR review: 
1,934,531 pages were declassified in their entirety 
(62 percent), and 904,463 pages were declassified 
in part (29 percent). 

However, agencies have been unable to keep pace 
with the influx of initial requests. From FY 1996 
through FY 2008, agencies carried over an average 
of 3,842 initial MDR requests from one fiscal year 
into the next. In FY 2008, agencies reported 5,843 



initial requests carried over into FY 2009. This 
figure increased again in FY 2009 as agencies 
reported 6,582 initial requests carried over into FY 
2010, an increase of 739 from the previous year 
and over 2,740 more than the FY 1996 through 
FY 2008 average. In FY 2008, three agencies — 
NARA (2,586 requests), DoD (1,667 requests), and 
CIA (1,063 requests) — accounted for the majority 
of requests carried forward into FY 2009. Those 
same agencies account for the majority of requests 
being carried forward into FY 2010 — NARA 
(2,762), DoD (2,165), and CIA (996). 

The Department of Energy (DOE) and DHS have 
made notable progress in decreasing the size 
of their MDR backlogs. DOE carried over 112 
requests into FY 2009 but only 71 into FY 2010. 
DHS carried over 51 requests into FY 2009 and 
only 3 into FY 2010. 
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Disposition of Initial MDR Requests, FY 1996 - FY 2009 



Declassified in part: 
904,463 pages 



Denied 

263,329 pages 




Declassified in 
their entirety: 
1,934,531 pages 



TOTAL: 3,102,323 pages 



Agencies processed 177 appeals in FY 2009. DoD (76 appeals, 43 percent), 
CIA (77 appeals, 43 percent), and NARA (14 appeals, 8 percent) accounted for 
94 percent of the total appeals processed in FY 2009. 



Appeals 

During FY 2009, agencies received 186 appeals 
of agency decisions to deny information after 
processing and deciding upon initial MDR requests. 
Three agencies accounted for 92 percent of these 
appeals: DoD (93 appeals, 50 percent), CIA (58 
appeals, 31 percent), and NARA (20 appeals, 

11 percent). Only three other agencies reported 
receiving new appeals: Air Force (6 appeals, 3 
percent), the Department of State (5 appeals, 3 
percent), and DOE (4 appeals, 2 percent). 

Agencies processed 104 appeals in FY 2007, 178 
appeals in FY 2008, and 177 appeals in FY 2009. 
DoD (76 appeals, 43 percent), CIA (77 appeals, 

43 percent), and NARA (14 appeals, 8 percent) 
accounted for 94 percent of the total appeals 



processed in FY 2009. Although agencies continue 
to report progress in adjudicating and processing 
appeals, ISOO remains concerned about the large 
backlog carried over each fiscal year. In FY 2007, 
agencies reported carrying over 105 appeals; in FY 
2008, agencies reported carrying over 183 appeals; 
and in FY 2009, 5 agencies (CIA, 71 appeals; DoD, 
47 appeals; DOE, 1 appeal; NARA, 53 appeals; 
and State, 20 appeals) reported carrying 192 
appeals into FY 2010. 

Of the 177 appeals processed in FY 2009, agencies 
reviewed 6,333 pages, representing a 2 percent 
decrease from the 6,472 pages reviewed in FY 
2008. However, this represents 1,740 pages more 
than the average of 4,632 pages reviewed from 
FY 1996 through FY 2008. The processing of 
MDR appeals by agencies in FY 2009 resulted 
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. . . agency representatives have informally pointed to the focus on the 
requirements of FOIA when speaking to their compliance with MDR 
requirements. Agencies must comply with all of the requirements of both 
FOIA and MDR by committing the necessary resources to ensure the effective 
implementation of both programs. 



in the declassification of information in 4,679 
pages, 74 percent of the pages reviewed. Of these 
pages, 1,350 were declassified in their entirety (21 
percent) and 3,329 were declassified in part (53 
percent). Agencies affirmed the classification of 
1,654 pages (26 percent) in their entirety. Since FY 
1996, agencies processed 66,555 appealed pages. 

Of these, 11,219 pages were declassified in their 
entirety (17 percent); 28,810 pages were declassified 
in part (43 percent); and 26,526 pages remained 
classified in their entirety (40 percent). 

MDR Program Requirements 

Agencies are expected to provide sufficient 
resources to process MDR requests, conduct 



a review of the information for its possible 
declassification, and adjudicate and process 
appeals in a timely manner. Agencies must 
evaluate their own MDR programs and take 
action to eliminate their MDR backlogs. Since 
the issuances of E.O. 13392, “Improving Agency 
Disclosure of Information,” on December 14, 
2005, and, more recently, the President’s FOIA 
memorandum of January 21, 2009, agency 
representatives have informally pointed to 
the focus on the requirements of FOIA when 
speaking to their compliance with MDR 
requirements. Agencies must comply with all 
of the requirements of both FOIA and MDR by 
committing the necessary resources to ensure the 
effective implementation of both programs. 



Disposition of MDR Appeals, FY 1996 - FY 2009 



Declassified in their 




TOTAL: 66,555 pages 
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Reviews 



Document Reviews 

To address a long-standing concern that Executive 
branch agencies fail to properly mark a large 
percentage of the classified documents they create, 
ISOO shifted emphasis during FY 2009 from on- 
site reviews to document reviews. ISOO began an 
oversight effort that focuses on documents created 
by agencies that generate the largest amounts of 
classified information. Based on the prior year’s 
Standard Form (SF) 311 data, ISOO selected 
15 agencies that made at least 10,000 derivative 
classification actions. ISOO analysts reviewed a 
minimum of 100 documents from each agency, 
limiting the review to documents created since 
February 2009. Since classified materials are 
commonly created and distributed electronically, 
ISOO’s review was conducted primarily in the 
electronic environment on government-wide and/ 
or agency-based classified information systems 
and networks. 

The review encompassed 1,565 documents, 
of which 1,019 documents (65 percent) 
contained discrepancies. There were a total of 
1,805 discrepancies in the documents or 115 
discrepancies per 100 documents. Three-fourths 
of the agencies had discrepancies in more than 50 
percent of their documents; several agencies had 
error rates higher than 90 percent. Of greatest 
concern were discrepancies that raised questions 
about the appropriateness of classification of the 
documents, such as the absence of a “Classified 
By” or “Derived From” line (18 percent of the 
documents), the failure to include a list of sources 
with documents derived from multiple sources 
(14 percent), and over-classification (3 percent). 

In total, the classification of 35 percent of the 
documents was questionable. 

The following list outlines major discrepancies that 
were identified: 

■ Classification Errors 

• No “Classified By” or “Derived From” line. 

• Multiple sources not identified. 



■ Marking Errors 

• Portion markings missing from subject 
lines, charts, and images. 

• Total absence of portion markings on a large 
percentage of slide presentations. 

■ Declassification Errors 

• No declassification instructions. 

• Invalid declassification instructions (MR, 
“DNI Only”). 

• Obsolete declassification instructions 
(OADR, X1-X8). 

• Use of automatic declassification exemption 
(25X1-9) without a date or event. 

• Use of 25X1 -human on documents that did 
not contain information that would reveal 
the identity of a confidential human source 
or human intelligence source. 

Agencies throughout the Executive branch must 
address the improper marking of their classified 
documents to ensure classified national security 
information is properly protected. Markings are 
applied to leave no doubt about the classified 
status of the information, the level of protection 
required, and the duration of classification. 

Agencies should provide more detailed and focused 
training to classifiers and perform regular reviews 
of representative samples of their original and 
derivative classification actions. Agencies could 
supplement their on-site reviews of classified 
materials with an on-line review, similar to the 
ISOO document review, which can extend the 
reach of their security offices and help identify 
activities that need further oversight and assistance 
with marking and classification. Electronic 
marking tools that compel classifiers to apply the 
required markings can significantly reduce the 
number of marking errors; document templates can 
also help in this area, as does the application of 
quality control procedures. Given the persistence 
and pervasiveness of marking and classification 
discrepancies in the Executive branch, all agencies 
must make a determined and sustained effort to 
correct them. With the issuance of E.O. 13526, we 
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ISOO conducted three general on-site program reviews of Executive branch 
agencies. Each agency was deficient in at least one core element of the program, 
including program management, classification management, security education 
and training, and self-inspections. 



now have additional training requirements for all 
original and derivative classifiers, and the ability 
to hold derivative classifiers accountable for their 
actions. This should lead to greater accuracy and 
reduce over-classification. 

On-Site Reviews 

During FY 2009, ISOO conducted three 
general on-site program reviews of Executive 
branch agencies. Each agency was deficient 
in at least one core element of the program, 
including program management, classification 
management, security education and training, 
and self-inspections. Specific problems identified 
in the organization and management of agency 
programs included the lack of updated agency 
implementing regulations and non-compliance 
with the requirement that the performance 
contract or other system used to rate civilian 
or military personnel performance include 
the management of classified information 
as a critical element or item to be evaluated 
in the rating of OCAs, security managers or 
security specialists, and all other personnel 
whose duties significantly involve the creation 
or handling of classified information. 

Each of the agencies was deficient in at least 
one element of classification management: the 
appropriateness of classification was questionable in 
over 17 percent of 646 documents reviewed during 
the on-site reviews, and a number of classification 
guides had not been reviewed and updated in the 
past five years. One agency did not have formal 
procedures in place to allow for classification 
challenges. One agency’s security education and 
training program did not cover required elements 
for initial briefings, nor did it provide specialized 
training for derivative classifiers. At one agency, 
the self-inspection program was ineffective in 
evaluating the marking of classified documents. 



Declassification Assessments 

In FY 2009, ISOO continued an initiative begun 
in FY 2008 to evaluate the results of agencies’ 
automatic declassification review programs. Using 
SF 311 submission data from FY 2008, ISOO 
identified 19 agencies whose declassification 
programs were substantial enough to warrant 
assessment. Each agency was contacted in March 
2009 and asked to provide information on bodies of 
records for which they completed declassification 
reviews during the six month period from October 
1, 2008, through March 31, 2009. ISOO analysts 
used the data collected to determine the sample 
size and specific documents to review during on- 
site declassification assessments. 

From May through August 2009, ISOO analysts 
conducted on-site declassification assessments and 
evaluated the program results for each of the 19 
agencies. Assessments focused on three areas of 
concern: missed equities, inappropriate referrals, 
and improper exemptions. A commonly missed 
equity was the mention of the security classification 
interest of one agency in the record of another 
agency that had not been identified by the initial 
reviewer for referral to that agency. Inappropriate 
referrals denoted occasions when referrals were 
made to agencies that lacked the authority to exempt 
information from declassification or had waived their 
interest in the information. Improper exemptions 
included instances in which agencies attempted to 
exempt a document from automatic declassification 
under an exemption category not permitted by 
that agency’s declassification guide as approved by 
ISCAP. The occurrence of any of these three issues 
was noted by ISOO analysts and factored into the 
agency score. In addition to these three categories 
of findings from within the statistical sample, ISOO 
analysts examined records from outside the sample 
in order to develop a more complete picture of 
agencies’ declassification programs. 
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. . . agencies have shown improvement in their declassification programs since 
the FY 2008 assessments. The average score increased by nearly 5 percent, and 
the number of agencies receiving scores of 90 or above increased 17 percent. 



Within the statistical sample, ISOO analysts 
encountered examples of missed equities in 3 of 
19 agency samples and inappropriate referrals in 
5 of 19 agency samples. ISOO found relatively 
few examples of improper exemptions, with only 
2 of the 19 agencies committing this error. In 
their observations outside the sample, ISOO 
found seven agencies not consistently using the 
Declassification Review Tab (SF 715) and eight 
making inappropriate referrals. Additionally, seven 
were not including summary sheets in their boxes 
to explain their actions, and five were reviewing 
records during the reporting period that were 
significantly older than 25 years. 

The results of these assessments were recorded, 
and scores were assigned to the agencies. ISOO 
allocated up to 60 points for the objective findings 
within the statistical sample and up to 40 points for 
the programmatic observations, for a possible total 
of 100 points. Of the 19 agencies ISOO assessed, 

10 received scores of 90 or above, 6 received scores 
from 70 to 89, and 3 received scores of 69 and 
below. ISOO is pleased to report that agencies 
have shown improvement in their declassification 
programs since the FY 2008 assessments. The 
average score increased by nearly 5 percent, and the 
number of agencies receiving scores of 90 or above 
increased 17 percent. ISOO will begin publishing 
agency scores in the FY 2010 annual report. 

ISOO will continue to conduct annual assessments 
and issue notices to agencies in order to provide 
specific guidance on areas of concern they 
encounter. ISOO Notices may be found on the ISOO 
website (http://www.archives.gov/isoo/notices). 



Classification Guides 

All agencies with original classification authority 
are required to prepare security classification guides 
to facilitate the proper and uniform derivative 
classification of information. Continuing an 
effort that began in FY 2008 to assess agencies’ 
compliance with the requirement, ISOO requested 
that agencies provide updated lists of security 
classification guides, identifying guides by name 
and/or number and providing the date that each 
classification guide was issued, as well as the 
date of the last review and update. Executive 
branch agencies reported that there were 2,390 
guides in use. Only 54 percent of these guides 
have been updated within the past five years as 
required. While this is an improvement over the 
33 percent compliance rate reported in FY 2008, 
it nevertheless represents a significant failure by 
agencies to properly exercise the authority delegated 
to them by the President. This failure means that 
a large percentage of guides do not reflect current 
classification needs and may not adequately protect 
information that reasonably could be expected to 
cause damage to the national security. Two large 
agencies, responsible for 65 percent of the guides 
in use, reported that only 33 percent of their guides 
have been updated within the previous five years. 
Compliance in the other Executive branch agencies 
collectively stands at 93 percent. With the recent 
issuance of E.O. 13526, agencies will be required to 
conduct fundamental classification guidance reviews 
on a periodic basis. ISOO will continue to work 
with the agencies to improve overall compliance 
with these requirements. 
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Interagency Security Classification Appeals Panel 



Authority 

Section 5.3 of E.O. 13526, "Classified National 
Security Information." 

Functions 

To advise and assist the President in the discharge 
of his constitutional and discretionary authority to 
protect the national security of the United States by: 

1. deciding on appeals by authorized persons who 
have filed classification challenges; 

2. approving, denying, or amending agency 
exemptions from automatic declassification; and 

3. deciding on appeals by persons or entities who 
have filed requests for MDR. 

Members 

William H. Leary, Chair 
National Security Council 

Matthew G. Olsen 
Department of Justice 

Joseph W. Lambert 
Central Intelligence Agency 

Margaret P. Grafeld 
Department of State 

Laurence K. Burgess 
Department of Defense 

Michael J. Kurtz 

National Archives and Records Administration 

Executive Secretary 

William J. Bosanko, Director 
Information Security Oversight Office 

Support Staff 

Information Security Oversight Office 



Background 

ISCAP was established to perform the functions 
noted above. ISCAP began meeting in May 1996 
and is comprised of senior level representatives 
appointed by the Secretaries of State and 
Defense; the Attorney General; the Director of 
the Central Intelligence Agency (D/CIA); the 
Archivist of the United States; and the Assistant 
to the President for National Security Affairs. 
ISCAP’s Chair is selected by the President, the 
Director of the Information Security Oversight 
Office serves as Executive Secretary, and ISOO 
provides staff support. 

Mandatory Declassification 
Review Appeals 

During FY 2009, ISCAP allocated a majority 
of its time and resources to processing MDR 
appeals, finalizing decisions on 72 documents. 

The Panel declassified additional information in 
50 documents (69 percent) and affirmed the prior 
agency classification decisions in 22 documents 
(31 percent). Of the 50 documents in which 
information was declassified, 21 documents (29 
percent) were declassified in their entirety and 
29 documents (40 percent) had some portions 
declassified while the classification of other 
portions was affirmed. 

Since May 1996, the Panel has decided upon 
a total of 841 documents. Of these, ISCAP 
declassified additional information in 65 percent 
of the documents. Specifically, 188 documents 
(22 percent) were declassified in their entirety, 
and 357 documents (43 percent) had some 
portions declassified while the classification of 
other portions was affirmed. During this time, 
ISCAP fully affirmed the classification decisions 
of agencies in 296 documents (35 percent). 
Documents declassified by ISCAP may be 
requested from the Executive branch agency that 
has custody of them. 
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ISCAP Decisions, FY 2009 



Affirmed 
Classification: 
22 documents 




Declassified in 
their entirety: 
21 documents 



Declassified in part: 
29 documents 



TOTAL: 72 Documents 



. . . many agencies have seen large increases in the number of requests received. 
The increasing number of initial MDR requests to agencies has led to challenges 
in processing MDR requests and appeals within the allowed time frames. As 
a result, ISCAP has noted a dramatic increase in the number of MDR appeals 
brought before the Panel due to agency inaction. Agencies must take action, 
including augmenting staff resources, to ensure appropriate case processing 
within the allotted timeframes. 



MDR is an increasingly popular method for 
members of the public as a means to request a 
declassification review of specific documents. 
Accordingly, many agencies have seen large 
increases in the number of requests received. 

The increasing number of initial MDR requests 
to agencies has led to challenges in processing 
MDR requests and appeals within the allowed 
time frames. As a result, ISCAP has noted 
a dramatic increase in the number of MDR 
appeals brought before the Panel due to agency 
inaction. Agencies must take action, including 
augmenting staff resources, to ensure appropriate 
case processing within the allotted timeframes 
as specified by section 3.5 of the Order and its 
implementing directives. 



In FY 2004, ISCAP received 35 appeals; in FY 

2005, ISCAP received 26 appeals; and in FY 

2006, ISCAP received 34 appeals. In FY 2007 
and FY 2008, the Panel received 57 and 58 appeals 
respectively. In FY 2009, the volume of incoming 
MDR appeals rose to 91 appeals. 

If you have any questions concerning ISCAP, 
please contact the ISCAP staff: 

Telephone: 202.357.5250 
Fax: 202.357.5907 
E-mail: iscap@nara.gov 

Additional information about ISCAP may be found 
on the ISOO website 

www.archives.gov/isoo/oversight-groups/iscap 
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ISCAP Decisions, May 1996 - September 2009 




TOTAL: 841 documents 
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National Industrial Security Program 



ISOO is responsible for implementing and 
overseeing the National Industrial Security 
Program (NISP) under E.O. 12829, as amended, 
issued in 1993. This oversight responsibility is 
primarily executed through the National Industrial 
Security Program Policy Advisory Committee 
(NISPPAC), a Federal Advisory Committee 
organized pursuant to section 103 of E.O. 12829, 
as amended. Membership of the NISPPAC is 
comprised of both Government and industry 
representatives, and the NISPPAC is chaired by the 
Director of ISOO. 

The NISPPAC is responsible for recommending 
changes to industrial security policy, specifically 
E.O. 12829, as amended, its implementing directive 
(32 C.F.R. Part 2004), and the National Industrial 
Security Program Operating Manual (NISPOM). 
The NISPPAC advises on all matters involving the 
policies of the NISP and facilitates a discussion 
forum for policy issues. The NISPPAC convenes 
at least twice a calendar year at the discretion of 
the NISPPAC Chair, and the meetings are open to 
the public in accordance with the Federal Advisory 
Committee Act. 



During FY 2009, three meetings of the NISPPAC 
were held. The following issues were presented 
and discussed: personnel security, clearance 
processing, trust suitability determinations, 
certification/accreditation of information systems 
processing classified information, industry access 
to threat data, and revisions of the NISPOM. 

Under the auspices of the NISPPAC, two ad hoc 
working groups formed during FY 2008 continued 
to meet on a periodic basis to address NISPPAC 
action items. A third ad hoc working group, 
Foreign Ownership Control and Influence (FOCI), 
was formed during FY 2009 to address specific 
issues related to FOCI of cleared contractors, 
licensees, or grantees. 

The Personnel Security Clearance ad hoc working 
group brought together representatives from 
the Office of Personnel Management, DoD, and 
industry to review and analyze a comprehensive 
system of metrics that included key data points to 
measure the timeliness of clearance processing for 
industry. The analysis of these metrics resulted in 
the identification of suggested improvements to the 



security clearance process, some of which have 
been adopted for implementation. A noteworthy 
accomplishment was the implementation of 
the Secure Web Fingerprint Transmission 
(SWFT) system that facilitates the electronic 
submission of fingerprints in conjunction with 
the electronic security investigation (eQip) 
program. The working group also coordinated 
the establishment of the Clearance Adjudication 
and Tracking System (CATS) which allows 
for the coordination of adjudication issues 
via existing electronic platforms. When fully 
implemented, SWFT and CATS are expected to 
cut the processing time for security clearances 
by at least 10 days. 

The Office of the Designated Approval Authority 
ad hoc working group was renamed the 
Certification and Accreditation (C&A) working 
group. The objective of the working group is 
to bring transparency to the C&A process so 
that participants understand the requirements 
and responsibilities for the C&A of information 
systems. The group continues to develop policy 
and metrics to measure the timeliness of the C&A 



for information systems in order for industry to 
process classified national security information. The 
members of the working group include representatives 
from the Defense Security Service and industry. The 
group conducted quarterly meetings during the fiscal 
year and briefed the NISPPAC. 

The FOCI ad hoc working group completed two 
major initiatives in FY 2009. The first was the 
development of revisions to 32 C.F.R. Part 2004 
to delineate the process for conducting national 
interest determinations. The second was the 
successful adaptation of DOE’s e-FOCI system for 
implementation across the Executive branch. The 
intent of the adapted system is to expedite complex 
FOCI adjudications. 

The ad hoc working groups enhance the NISPPAC 
by gathering empirical data and developing process 
improvements to produce effective results for 
the program as a whole. The continuing work 
of the groups is reported at NISPPAC meetings. 
Information on the NISPPAC is available on the 
ISOO website (http://www.archives.gov/isoo/ 
oversight-groups/nisppac) . 
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Acronyms and Abbreviations 



Air Force: 
Army: 
C&A: 
CATS: 

CIA: 

D/CIA: 

DHS: 

DNI: 

DoD: 

DOE: 

E.O.: 

FOCI: 

FOIA: 

FY: 

ISCAP: 



Department of the Air Force 

Department of the Army 

certification and accreditation 

Clearance Adjudication and 
Tracking System 

Central Intelligence Agency 

Director of the Central 
Intelligence Agency 

Department of Homeland Security 

Director of National Intelligence 

Department of Defense 

Department of Energy 

Executive Order 

Foreign Ownership Control 
and Influence 

Freedom of Information Act 
Fiscal Year 

Interagency Security Classification 
Appeals Panel 



ISOO: 

MDR: 

NARA: 

Navy: 

NISP: 

NISPOM: 

NISPPAC: 

NSC: 

OCA: 

PIDB: 

SF: 

SWFT: 



Information Security 
Oversight Office 

mandatory declassification review 

National Archives and 
Records Administration 

Department of the Navy 

National Industrial Security 
Program 

National Industrial Security 
Program Operating Manual 

National Industrial Security 
Program Policy Advisory 
Committee 

National Security Council 

original classification authority 

Public Interest 
Declassification Board 

Standard Form 

Secure Web Fingerprint 
Transmission 
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